Jira (PUP-7559) puppet doesn't specify file type to get default selinux context

Alfredo Moralejo (JIRA)

unread,

May 17, 2017, 1:03:15 PM5/17/17

to puppe...@googlegroups.com

Alfredo Moralejo created an issue

Puppet /

PUP-7559

puppet doesn't specify file type to get default selinux context

Issue Type:	Bug
Affects Versions:	PUP 4.8.2
Assignee:	Unassigned
Created:	2017/05/17 10:02 AM
Priority:	Normal
Reporter:	Alfredo Moralejo

When creating a new file, puppet finds out the default selinux context with matchpathcon but it's not specifying the file type what can lead to use the incorrect context (selinux default context depends on file type) and breaks idempotency.

Reproducer:

[root@vmname ~]# cat test.pp
file

{ '/etc/systemd/system/redis.service.d': ensure => directory }

puppet apply test.pp
Notice: Compiled catalog for vmname.example.com in environment production in 0.15 seconds
Notice: /Stage[main]/Main/File[/etc/systemd/system/redis.service.d]/ensure: created
Notice: Applied catalog in 0.54 seconds
ll -Zd /etc/systemd/system/redis.service.d
drwxr-xr-x. root root system_u:object_r:redis_unit_file_t:s0 /etc/systemd/system/redis.service.d
puppet apply test.pp
Notice: Compiled catalog for vmname.example.com in environment production in 0.15 seconds
Notice: /Stage[main]/Main/File[/etc/systemd/system/redis.service.d]/seltype: seltype changed 'redis_unit_file_t' to 'systemd_unit_file_t'
Notice: Applied catalog in 0.51 seconds
[root@vmname ~]# ll -Zd /etc/systemd/system/redis.service.d
drwxr-xr-x. root root system_u:object_r:systemd_unit_file_t:s0 /etc/systemd/system/redis.service.d
[root@vmname ~]#

Note that first run used wrong selinux type for the just created directory.

Add Comment

This message was sent by Atlassian JIRA (v6.4.14#64029-sha1:ae256fe)

Alfredo Moralejo (JIRA)

unread,

May 17, 2017, 1:05:03 PM5/17/17

to puppe...@googlegroups.com

Alfredo Moralejo updated an issue

Puppet /

PUP-7559

puppet doesn't specify file type to get default selinux context

Change By:	Alfredo Moralejo

When creating a new file, puppet finds out the default selinux context with matchpathcon but it's not specifying the file type what can lead to use the incorrect context (selinux default context depends on file type) and breaks idempotency.

Reproducer:

{code}

[root@vmname ~]# cat test.pp
file {
'/etc/systemd/system/redis.service.d':
ensure => directory
}

# puppet apply test.pp

Notice: Compiled catalog for vmname.example.com in environment production in 0.15 seconds
Notice: /Stage[main]/Main/File[/etc/systemd/system/redis.service.d]/ensure: created
Notice: Applied catalog in 0.54 seconds

# ll -Zd /etc/systemd/system/redis.service.d
drwxr-xr-x. root root system_u:object_r:redis_unit_file_t:s0 /etc/systemd/system/redis.service.d
# puppet apply test.pp

Notice: Compiled catalog for vmname.example.com in environment production in 0.15 seconds
Notice: /Stage[main]/Main/File[/etc/systemd/system/redis.service.d]/seltype: seltype changed 'redis_unit_file_t' to 'systemd_unit_file_t'
Notice: Applied catalog in 0.51 seconds
[root@vmname ~]# ll -Zd /etc/systemd/system/redis.service.d
drwxr-xr-x. root root system_u:object_r:systemd_unit_file_t:s0 /etc/systemd/system/redis.service.d

[root@vmname ~]#

{code}

Note that first run used wrong selinux type for the just created directory.